Managing associations between device identifiers

ABSTRACT

Device identifiers for devices, such as computing devices, software, and applications, etc., are analyzed to determine whether the device identifiers are associated with each other (e.g., are connected to each other) and how strongly the device identifiers are associated with each other. A stronger connection between two device identifiers may indicate that the device identifiers are connected to the same user, same computing device, or same household. Connections between device identifiers are identified and/or weighted if the device identifiers are associated with the same network or if the device identifiers use the same login information to access content. The identifiers and their connections may form a device graph. Content is targeted to the clients based on the device graph. The device graph may also be used to perform targeting and orchestration of advertising, attribution reporting, analytics, and content optimization across devices in the device graph.

RELATED APPLICATIONS

This Application is a Continuation of U.S. application Ser. No.13/677,110, filed Nov. 14, 2012, entitled “MANAGING ASSOCIATIONS BETWEENDEVICE IDENTIFIERS”, which is a Non-Provisional of Provisional (35 USC119(e)) of U.S. Application Ser. No. 61/563,963, filed Nov. 28, 2011,entitled “SYSTEM AND METHOD FOR USING DEVICE SIGNATURES TO TRACK USERSIN A PRIVACY-SECURE MANNER”. Application Ser. No. 13/677110 is aNon-Provisional of Provisional (35 USC 119(e)) of U.S. Application Ser.No. 61/563,277, filed Nov. 23, 2011, entitled “SYSTEM AND METHOD FORUSING DEVICE FINGERPRINTS TO TRACK USERS IN A PRIVACY-SECURE MANNER”.Application Ser. No. 13/677110 is a Non-Provisional of Provisional (35USC 119(e)) of U.S. Application Ser. No. 61/559,879, filed Nov. 15,2011, entitled “SYSTEM AND METHOD FOR REAL-TIME BIDDING ACROSS BRIDGEDPLATFORMS”, the contents of which are hereby incorporated by referenceherein.

BACKGROUND

The use of computing devices such as computer systems, smartphones,laptops computers, tablet computers, netbook computers, smarttelevisions, personal digital assistants (PDAs), cell phones, mediaplayers, gaming consoles (e.g., PlayStation®, XBOX®), smart televisions(TVs), etc., is now prevalent. Users often employ various computingdevices and various applications to access content online. For example,a user may use a laptop computer and a first type of browser (e.g.,Firefox®) to access a news website or a social networking website whenthe user is at home. The user may also use a smartphone and a secondtype of browser (e.g., Safari®) to access such websites (e.g., the newswebsite and/or the social networking website) when the user is atanother location (e.g., at work or at a grocery store, etc.). The usermay also use various applications to access online content. For example,many publishers, such as news, email, and/or social network publishers(e.g., Yahoo®, Facebook®, CNN®, or other companies or entities thatprovide online content, etc.) provide applications which allow users toaccess email, website, and/or other content without using a browserapplication.

Many entities (such as companies that sell/market goods or services,advertisers, marketing firms, etc.) use various forms of onlineadvertising to advertise and/or market various products and/or servicesto user. Online advertising may involve the serving of advertisements(e.g., banners, text, images, video clips, audio clips, other richmedia, etc.) to users when the users access content (e.g., when a uservisits a particular website or when a user views a particular streamingvideo). For example, when a user visits a website, an advertisementserver may deliver and/or provide an advertisement to a region and/orportion of the website for viewing by the user. The size and position ofthe advertisement may vary based on the design of the particularwebsite. For example, the advertisement may be a banner with text andimages that is displayed in a left region of the website (e.g., alongthe left side of the website). In another example, the advertisement maybe a video clip that is displayed on the top region of the website(e.g., along the top of the website).

In order to achieve better targeting of specific audiences of users,many advertisers and/or companies use techniques such as cookies andpixels to track how users are interacting with different websites.Cookies may be data that is sent from a website and stored in a user'sweb browser. The cookie data may be accessed while a user is browsingthe website. Some websites contain instructions that can save and editinformation in a user's cookie. For example, a cookie generated by aretail website may contain information such as (i) products viewedand/or purchased by a user, (ii) information about the user such asinternet protocol (IP) address, computer/browser type, and (iii)date/time of the user's last visit to the website. Pixels may be used toplace and update cookies and may allow third parties (such as websitepublishers and/or advertisers) to place and update cookies in order totrack how and when users are interacting with particular websites. Byusing cookies and pixels to track user interaction with certainwebsites, advertisers and/or companies may be able to personalize andorchestrate advertising or content to certain types of users based oninformation gathered from the cookies and pixels.

SUMMARY

Companies and/or advertisers use tracking techniques such as cookies andpixels to track how users interact with different websites and otherdigital services. However, these techniques do not allow advertisers totrack the activities of users across multiple browsers and/orapplications on the same device. For example, different applications(e.g., different browsers applications such as Firefox® and Safari®) onthe same computing device may appear as different devices/identifiers toserver systems/platforms (e.g., software, servers, computers and/orother components used by advertisers and companies to provide and trackadvertisements). These techniques also do not allow advertisers and/orcompanies to track the activities of users across multiple devices. Forexample, a user may have both a laptop computer and a smartphone.Existing techniques, such as cookies and pixels, may not be able to linkor track the user's behavior and/or activities across both the laptopcomputer and the smartphone. Consequently, advertisers are not able totarget and/or orchestrate advertisements (e.g., ads) to the same user onmultiple devices or across multiple browsers/applications.

System and methods of tracking, managing, and/or using deviceidentifiers are disclosed herein. A device identifier may be anidentifier (e.g., a cookie ID, a derived identifier based on websiteheader information, such HyperText Transfer Protocol header (HTTP)header information/fields, and other parameters, a hardware or anoperating system identifier (such as an iOS® Identifier For Advertisers(IDFA) or an Android® device ID for a smartphone, etc.), a networkdevice identifier such as an Internet Protocol (IP) address for alaptop, a Medium Access Control (MAC) address for a tablet, anInternational Mobile Equipment Identity (IMEI) number for a smart phone,etc.) used by a device when the device accesses content (e.g., access anews website, access posts or messages on a social networking website,etc.). A device may be a computing device (e.g., a smartphone, a tabletcomputer, a laptop computer, a desktop computer, etc.) and/or anapplication, software, software modules, and/or other component on thecomputing device (e.g., a web browser, a mobile application installed ona smartphone, etc.). When the different computing devices, applications,software, software modules and/or other components access content (e.g.,websites, services, and/or locations) online, one or more deviceidentifiers may be recorded, captured, and/or stored by servers thathost the content. For example, when a user access a news website using aweb browser application on a smartphone, the servers that host contentfor the news website may record the IP address of the computing device,other website header information (e.g., HTTP header information/fields),and an identifier for the web browser application (e.g., an identifierin a cookie for the website such as a cookie ID, a Globally UniqueIDentifier (GUID)).

In one embodiment, the servers may provide network data to an identifiermodule or the servers may provide the network data to a network dataserver that may provide the network data to the identifier module. Thenetwork data may include a device identifier for a device (e.g., acomputing device and/or an application), a type of a network used by thedevice (e.g., a residential/home network), an identifier for the network(e.g., an IP address for the network gateway), an identifier for theservers that host the content (e.g., an IP address or a domain name forthe servers), information about a software/application (such as the typeof a browser application/user agent), other website header information(e.g., HTTP header information/fields), and/or a time that the contentwas accessed (e.g., Sep. 1, 2012 at 1:25 PM PST). In one embodiment, theheader information may include information such as the type ofapplication or software, modules that are used by the application orsoftware (e.g., add-ons or extensions used by a browser application),the type of operating system that the application or software is runningon, type and version of browser, etc. All or some of the informationabove may also be referred to as a user-agent string. In one embodiment,the website header information may include HTTP headerinformation/fields including, but not limited to, the domain name of aserver that hosts content, a date, a referrer (e.g., the name of aprevious website or web page), the content type (e.g., HTML content,portable document format (PDF) content, digital video, etc.), a cookieID, authorization credentials (e.g., username and/or password), etc.

The identifier module may use the network data to identify connectionsbetween different device identifiers. For example, a first device with afirst device identifier (e.g., a smartphone with a an iOS® IDFA) mayaccess a mobile application and second device with second deviceidentifier (e.g., a laptop with a cookie ID) may access a differentwebsite using the same network (e.g., both devices access the differentwebsites from the same Wi-Fi network in a user's residence or home). Theidentifier module may associate the first device identifier (e.g., theiOS® IDFA) and the second device identifier (e.g., the cookie ID) witheach other because both device identifiers used the same network (e.g.,may identify a connection between the first device identifier and thesecond device identifier). In another example, a user may log into apartner's (e.g., advertiser's, publisher's) website or application thatrequires user credentials using a web browser application (with a cookieID) on a laptop and may later use a mobile application on a smartphone(with a Android® device ID) to log into the same partner's (e.g.,advertiser's, publisher's) website/application. The identifier modulemay associate the cookie ID with the Android® device ID (e.g., mayidentify a connection between the cookie ID and the Android® device ID)because both the cookie ID and the Android® device ID were used bydevices (e.g., computing devices, software, and/or applications) whenaccessing the partner's (e.g., advertiser's, publisher's) website. Inone embodiment, the identifier module may collect anonymized logininformation (e.g., hashed/obfuscated usernames) from differentadvertisers/publishers (e.g., from an email website). The identifiermodule may identify a connection between two different deviceidentifiers (e.g., between the computing devices and/or applicationsassociated with the different device identifiers) if the two differentdevices use the same login information to access content from thepartner (e.g., advertiser, publisher).

In one embodiment, the identifier module may assign weights to theconnections between the device identifiers. The identifier may alsoadjust or modify the weights based on various criteria and/or conditions(as discussed in more detail below in conjunctions with FIGS. 1-7). Forexample, the weight of a connection between a first device identifierand a second device identifier may be increased if the two deviceidentifiers use the same network to access content within a certainperiod of time (e.g., within seven days). In another example, the weightof the connection between the first device identifier and the seconddevice identifier may be decreased if the two device identifiers do notuse the same network to access content within a certain period of time(e.g., within thirty days).

In one embodiment, the identifier module may use the connections and/orthe weights of the connections between device identifiers to providecontent, such as advertising, to different devices. For example, theidentifier module may perform advertisement targeting and/or retargetingof users or audiences across different computing devices. In anotherexample, the identifier module may perform attributions (e.g.,attributing a sale or conversion to an advertisement) across differentcomputing devices. In a further example, the identifier module mayperform other functions including, but not limited to, brand surveydelivery, campaign/audience analytics, frequency capping, and lookalikemodeling, across different computing devices and/or applications.

The above summary is a simplified summary of the disclosure in order toprovide a basic understanding of some aspects of the disclosure. Thissummary is not an extensive overview of the disclosure. It is intendedto neither identify key or critical elements of the disclosure, nordelineate any scope of the particular implementations of the disclosureor any scope of the claims. Its sole purpose is to present some conceptsof the disclosure in a simplified form as a prelude to the more detaileddescription that is presented later.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure will be understood more fully from the detaileddescription given below and from the accompanying drawings of variousembodiments of the present disclosure, which, however, should not betaken to limit the present disclosure to the specific embodiments, butare for explanation and understanding only.

FIG. 1 is a diagram illustrating an exemplary device graph, according toone embodiment.

FIG. 2 is a diagram illustrating an exemplary device graph, according toanother embodiment.

FIG. 3 is a block diagram of an exemplary network architecture, in whichembodiments of the present disclosure may operate.

FIG. 4 is a block diagram illustrating an identifier module and anadvertising module, according to one embodiment.

FIG. 5 is a flow diagram illustrating a method of identifyingconnections, according to one embodiment.

FIG. 6 is a flow diagram illustrating a method of updating connectionsand weights in a device graph, according to one embodiment.

FIG. 7 is a flow diagram illustrating a method of using a device graph,according to one embodiment.

FIG. 8 is a block diagram illustrating one embodiment of a computingdevice, according to an embodiment.

DETAILED DESCRIPTION

FIG. 1 is a diagram illustrating an exemplary device graph 100,according to one embodiment. The device graph 100 includes six deviceidentifiers, device identifier A, device identifier B, device identifierC, device identifier D, device identifier E, and device identifier F. Asdiscussed above, the device identifier may be an identifier used by adevice when the device accesses content (e.g., accesses a news website).Device identifier A is a cookie ID for a browser application on asmartphone, device identifier B is an MAC address for a computing devicethat has been hashed using the Message Digest-5 (MD-5) hashingfunction/algorithm, device identifier C is an iOS® Identifier ForAdvertisers (IDFA), device identifier D is a Android® device ID, deviceidentifier E is a cookie ID for a browser application on a desktopcomputer, and device identifier F is a cookie ID for a browserapplication on an Android® device. In the device graph 100, a deviceidentifier may represent a device that associated with the deviceidentifier (e.g., may represent the device that is using the deviceidentifier). In one embodiment, a device may be a computing deviceand/or an application, software, software modules, and/or othercomponent on the computing device. For example, the device may be one ormore of a desktop computer, a laptop computer, a server computer, a PDA,smartphone, web-enabled television set, smart television set, a gamingconsole, and/or any other device capable of to processing, managingand/or transmitting data. In another example, the device may besoftware, a software module, an application, and/or other component on acomputing device. In another example, the device may be one or more of aweb browser, an application (e.g., a mail application or a socialnetworking application installed on smartphone), a game application, amedia player application (e.g., a video player or a music player), asoftware module (e.g., an add-on or a component for a browserapplication), etc.

Each device (e.g., each computing device and/or each software orapplication) may have one or more device identifiers. For example, asmartphone (e.g., a device) may have a MAC address, a serial number(e.g., a serial number from a manufacturer an Open Device IdentificationNumber (ODIN), a Unique Device Identifier (UDID), an OpenUDID, aGlobally Unique Identifier (GUID), an IMEI number, an IP address, etc.,which may each be device identifiers. In another example, applications,software, and/or software modules may also have device identifiers. Forexample, an application on a computing device may have a serial numberwhich may be the device identifier for the application. In anotherexample, a web browser application may have cookie which includes anidentifier and the identifier in the cookie (e.g., the cookie ID) may bethe device identifier for the web browser application. In a furtherexample, an application (e.g., a mobile news application, a game, etc.)may use different types of device identifiers (e.g., a GUID, a UUID,etc.). In other embodiments, device identifiers may include, but are notlimited to, IP addresses, a MAC addresses, IMEI numbers, serial numbers,ODINs, UDIDs, OpenUDIDs, GUIDs, cookie IDs, an iOS® IDFA, an Identifierfor Vendors (IDFV), and/or any other data/information which may be usedto identify a device (e.g., an application, software, and/or a computingdevice). In one embodiment, a device identifier may be a number (e.g.,734598238742), an alphanumeric value (e.g., A984FDSJL334), a string ofcharacters (e.g., HZ$98!324*J), or any type of value that may be used toidentify a device (e.g., an application, software, and/or a computingdevice).

In one embodiment, a device (e.g., a computing device, an application,software, a software module, etc.) may generate a device identifier. Forexample, when the application (e.g., a device) is installed onto thecomputing device the application (or an installer/install file for theapplication) may generate a device identifier based on a MAC address forthe computing device. In another example, a computing device (e.g., adevice, such as a smartphone), may generate a device identifier based onother identifiers for the computing device (e.g., the smartphone maygenerate a device identifier based on an IMEI number or a UDID for thesmartphone). In some embodiments, the device (e.g., a computing device,an application, etc.) may use a variety methods, algorithms, operations,and/or functions, to generate device identifiers. For example, anapplication on a computing device may use a cryptographic hash function(e.g., Secure Hash Algorithm-1 (SHA-1), Secure Hash Algorithm-2 (SHA-2),Message Digest-5 (MD-5), etc.) to generate a device identifier for theapplication based on an IMEI for the computing device. In anotherexample, a computing device (e.g., a tablet computer) may use a randomnumber generator (e.g., a Pseudo-Random Number Generator (PRNG)) togenerate a device identifier based on a MAC address for the computingdevice.

Referring back to FIG. 1, the device identifier A is connected to deviceidentifier B via connection 105, to device identifier C via connection110, and to device identifier D via connection 125. The deviceidentifier B is connected to the device identifier C via connection 130and to device identifier D via connection 115. The device identifier Cis connected to the device identifier D via connection 120. Deviceidentifier E and device identifier F are not connected to other deviceidentifiers. Each of connections 105, 110, 115, 125, and 130 has aweight associated with the connection. Connection 105 has a weight of 5,connection 110 has a weight of 7, connection 115 has a weight of 3,connection 120 does not include a weight, connection 125 has a weight of1, and connection 130 has a weight of 5. In one embodiment, theconnections in the device graph 100 (e.g., connections 105, 110, 115,120, 125, and 130) may be identified based on (i) network data (e.g.,identified based on whether device identifiers used the samenetwork/network gateway), (ii) login information (e.g., based on whethertwo devices for two device identifiers used the same login informationto access content from a partner such as a publisher, an advertiser,etc.), and/or (iii) both network data and login information.

In one embodiment, the weight of the connection (e.g., the weight 7 forconnection 110) may be indicative of how closely or how strongly twodevice identifiers are associated with each other. For example, theweight for each connection may be a numeric value (e.g., a number). Ahigher numeric value may indicate that two device identifiers areclosely associated with each other and a lower numeric value mayindicate that two device identifiers are less closely associated witheach other. In one embodiment, a closer association between two deviceidentifiers may indicate that the two device identifiers originate fromthe same computing device. For example, a first device identifier may bean identifier for a computing device (e.g., a smartphone) and a seconddevice identifier may be for an application (e.g., a web browser) thatis used on the computing device. In another example, a first deviceidentifier may be an identifier for a first application (e.g., a webbrowser) on a computing device and the second device identifier may befor a second application (e.g., a game or a social networkingapplication) on the same computing device. In another embodiment, acloser association between two device identifiers may indicate that thetwo device identifiers originate from computing devices that are used bythe same user, or that are used by users who know each other (e.g.,members of a household, friends, etc.). For example, the first deviceidentifier may be for a first computing device (e.g., a smartphone) usedby a user and the second device identifier may be for a second computingdevice (e.g., a laptop computer) used by the same user. In anotherexample, the first device identifier may be for a first computing device(e.g., a tablet computer) used by a user and the second deviceidentifier may be for a second computing device (e.g., a laptopcomputer) used by a family member (e.g., husband, wife, brother, sister,son, daughter, etc.) of the user.

In one embodiment, the connections 105, 110, 115, 120, 125, and/or 130may also include other information in addition to the weights. Forexample, the connection 120 includes information (e.g., the text/value“login”) indicating that the connection 120 was established because thedevice associated with device identifier C and the device associatedwith device identifier D used the same login information (e.g., sameusername/password) to access content from a partner (e.g., publisher,advertiser). In another example, the connection 125 includes information(e.g., the text/value “login”) indicating that the connection 125 wasidentified because the device for device identifier A and the device fordevice identifier D used the same login information to access contentfrom a publisher (e.g., used the same username/password to access anemail account), and information (e.g., the weight “1”) indicating thatthe connection 125 was also identified because device identifier A anddevice identifier D used the same network gateway (e.g., accessed thepublisher service via the same Wi-Fi network). In addition, theconnection may also include information indicating the name of thepartner (e.g., a publisher, an advertiser, etc.) that provided the logininformation. For example, the connection may include the text/value“login—Gmail®” indicating that the login information was received fromGoogle®, or the connection may include the text/value “login/Pandora®”indicating that the login information was received from Pandora®. In afurther example, the connection may also include information indicatingwhere the network data (that was used to identify the connection) wasobtained from (e.g., a merchant server, a content server, anadvertisement server, a network data server, etc.). Although strings ortext are illustrated in FIG. 1 to represent the additional information,in other embodiments, the additional information (e.g., informationindicating how a connection was identified) may be represented usingother strings, numbers, alphanumeric values, and/or otherrepresentations. For example, the text “network” may be included in aconnection to indicate that the connection was identified because twodevice identifiers used the same network.

In one embodiment, the connections between the device identifiers maynot include weights. For example, when a connection between two deviceidentifiers is identified using login information, the connection maynot include a weight.

As discussed above, the connections 105, 110, 115, 120, 125, and 130,and the weights for the connections may be determined or identifiedusing network data and/or login information (e.g., username and/orpassword) that is used by different devices to access a partner's (e.g.,publisher's, advertiser's) website. The network data may include adevice identifier (e.g., an iOS® IDFA, a Android® device ID, anidentifier in a cookie, etc.) for a device (e.g., a computing deviceand/or an application), a type of a network used by the device (e.g.,whether the network is a residential/home network, or acommercial/business/corporate network), an identifier for the network(e.g., an IP address for the network, such as the IP address for a Wi-Firouter) that is used by the device, a type for the content that wasaccessed by the computing device and/or application (e.g., news content,music content, video content, etc.), an identifier for the servers thathost the content (e.g., an IP address or a domain name for the servers),user agent information (e.g., the type of a browser, such as Mozilla®,Safari®, Firefox®, Chrome®, Internet Explorer®, etc.), website headerinformation (e.g., HTTP headers/fields), and/or a time that the contentwas accessed (e.g., Sep. 1, 2012 at 1:25 PM PST). In one embodiment, thenetwork data may be generated, obtained and/or inferred by a server(e.g., tracking server 305, network data server 325, etc., as shown inFIG. 3) based on other data (e.g., based on other network data). Forexample, based on the IP address of a device, the server may be able todetermine the type of the network (e.g., whether the network is aresidential or a commercial network) by performing an IP address lookup.

The servers which host or store the content (e.g., websites, multimediacontent, etc.) that is accessed by the devices may obtain and/or recordnetwork data when the device accesses the content. For example, a serverthat hosts a news website may obtain a cookie ID for a web browser on asmartphone. In another example, a server that hosts social networkingcontent may obtain an IP address for a tablet computer that accesses thesocial networking content. In one embodiment, these servers may providethe network data (e.g., device identifiers, network types, identifiersfor the servers, etc.) to an identifier module (e.g., as illustrated anddiscussed further below in conjunction with FIGS. 3-4). The identifiermodule may obtain and/or create a device graph (such as device graph100) based on network data received from the servers. In anotherembodiment, the servers may provide the network data to a network dataserver (e.g., a server for an online data vendor/partner which collectsand stores the network). For example, the network data server maycollect network data from multiple servers that host different content.In another example, one or more of a content server, a merchant server,and an advertisement server may provide the network data to theidentifier module. The network data server may provide the network datato the identifier module. The identifier module may obtain and/or createa device graph (such as device graph 100) based on network data receivedfrom the servers. In a further embodiment, an application/software on acomputing may obtain device identifiers such as a MAC address, an IPaddress, an IMEI number, a UDID, etc., and may provide these identifiersto the identifier module. For example, a game application that isinstalled on a smartphone may obtain the iOS® IDFA for the smartphoneand may provide the iOS® IDFA to the identifier module.

In another embodiment, the identifier module may obtain logininformation and network data from different servers. The identifiermodule may identify connections between different device identifiers,based on the login information. For example, the identifier module mayobtain hashed login information that was used to access an email server.The identifier module may determine that two different devices (eachwith different device identifiers) used the same login information(e.g., same username and/or password) to access an email account. Theidentifier module may create a connection between the two deviceidentifiers (e.g., between the two devices) because the two devicesassociated with the two device identifiers used the same logininformation to access the email account.

In one embodiment, the weights for the connections 105, 110, 115, 120,125, and 130, and the weights may be increased or decreased based ondifferent criteria, rules, factors, and/or conditions. For example, theweight for the connection 105 may be increased if device identifier Aand device identifier B are seen on the same residential network withina period of time (e.g., seven days). In another example, the weight forconnection 130 may be decreased of device identifier B and deviceidentifier C have not been seen on the same residential network for aperiod of time (e.g., two weeks). The identifier module (as illustratedand discussed further below in conjunction with FIGS. 3-4) may increaseand/or decrease the weights for the connections 105, 110, 115, 120, 125,and 130 based on the network data received from the servers and/or thenetwork data server. The adjustment and/or modification of the weightare discussed in more detail below in conjunction with FIGS. 3-4.

In one embodiment, device identifiers may be removed from the devicegraph 100. For example, device identifier E is not connected to otherdevice identifiers. After a period of time (e.g., 30 days, 7 days,etc.), the device identifier E may be removed from the device graph 100if the device identifier E is still not connected to other identifiersor the device identifier has not been refreshed in a threshold period oftime. In another embodiment, device identifiers may be added to thedevice graph 100. For example, a new device identifier may be added tothe device graph and a new connection may connect the new deviceidentifier to device identifier F (not shown in the figures).

In one embodiment, a server may manage, update, and/or track all deviceidentifiers (e.g., all identifiers for computing devices, software,application, etc.) and the connections between all the deviceidentifiers using a single device graph. Because all device identifiersmay be included in a single device graph, the single device graph mayinclude disjointed groups of connected device identifiers and singledevice identifiers that have no connections. In another embodiment,there may be separate device graphs that contain different deviceidentifiers and connections.

FIG. 2 is a diagram illustrating an exemplary device graph 200,according to another embodiment. The device graph 200 also includesdevice identifier A, device identifier B, device identifier C, deviceidentifier D, device identifier E, device identifier F, and deviceidentifier G. Device identifier A is a cookie ID for a browserapplication on a smartphone, device identifier B is an MAC address for acomputing device that has been hashed using the Message Digest-5 (MD-5)hashing function/algorithm, device identifier C is an iOS® IdentifierFor Advertisers (IDFA), device identifier D is a Android® device ID,device identifier E is a cookie ID for a browser application on adesktop computer, device identifier F is a cookie ID for a browserapplication on an Android® device, and device identifier G is an IMEIfor a computing device that has been hashed using the Secure HashingAlgorithm-1 (SHA-1). The graph 200 also includes a merged identifierABC. The merged identifier ABC aggregates device identifier A, deviceidentifier B, and device identifier C, so that they are equivalent.Merged identifier ABC is connected to device identifier D via connection210 and connection 210 has a weight of 6. Device identifier D isconnected to device identifier G via connection 215 and connection 215has a weight of 4. Device identifier F is connected to device identifierG via connection 220 and the connection 220 has a weight of 2. Theconnection 220 also includes information (e.g., the text/value “login”)indicating that the connection 220 was identified because both thedevice identifier F and the device identifier G accessed content (e.g.,a website, a service, etc.) using the same login information (e.g., sameusername/password).

In one embodiment, device identifiers may be merged if the deviceidentifiers originate from the same computing device. For example,device identifier A may be an identifier for the computing device'soperating system (e.g., an iOS® IDFA), device identifier B may be anidentifier for a web browser (e.g., a cookie ID), and device identifierC may be an identifier for another application (e.g., a gameapplication) on the computing device (e.g., a serial number for a secondapplication). One of the applications (e.g., the game application) mayobtain different identifiers for the computing device and/or theapplications on the computing device. For example, the game applicationmay obtain the IMEI number, the iOS® IDFA, and a cookie ID. The gameapplication may provide these identifiers to the identifier module andmay indicate that these three identifiers originate from the samecomputing device and/or user. The identifier module may merge thedifferent identifiers in a device graph, based on this information. Inone embodiment, after device identifiers are merged, when the identifiermodule later accesses the device graph to find a device identifier, themerged device identifiers are stored as being equivalent to each other.For example, when the identifier module accesses device graph 200 tofind device identifier A, the device identifier A is stored in thedevice graph 200 as being equivalent to device identifier B and/ordevice identifier C.

In another embodiment, device identifier may be merged when cookiesyncing is performed. For example, an advertiser or a publisher mayimplement cookie syncing between an advertisement exchange (e.g., an adexchange where bids for advertisements are processed). Theadvertiser/publisher may use a first cookie ID (e.g., cookie ID A) andthe advertisement exchange may use a second cookie ID (e.g., cookie IDB). The identifier module may merge the first cookie ID and the secondcookie ID because the publisher and the advertisement exchange havesynced the two cookie IDs (e.g., both cookie IDs belong to the samedevice).

In one embodiment device identifiers may not be merged even though thedevice identifiers are associated with the same login information oruser credentials. For example, as discussed above, the identifier modulemay identify a connection between two device identifiers because the twodevice identifiers are associated with the same login information (e.g.,same user credentials). The identifier module may not merge the twodevice identifiers, but may indicate in the connection (e.g., in theextra information included in the connection) that the connection wasidentified based on login information. In another embodiment, deviceidentifiers may be merged if the device identifiers are associated withthe same user credentials for a server. For example, a user may usedesktop computer at work to log into an email website. The desktopcomputer may have the device identifier A. The user may also use anemail application on a smartphone to access the same email website whenthe user is away from a computer. The email application may have thedevice identifier B. The user may also use a web browser on a tabletcomputer to access the email website when the user is at home (e.g., atthe user's residence). The table computer may have the device identifierC. Because the user may use the same user credentials (e.g., username,password, personal identification number (PIN), etc.), the server thathosts the email website may provide network data indicating that deviceidentifiers A, B, and C, are all associated with the same usercredentials. The device identifiers A, B, and C, may be merged orcombined into the merged identifier ABC, based on the network data.

In one embodiment, when multiple device identifiers are merged, theconnections and the weights for the multiple device identifiers may alsobe merged or combined. For example, as illustrated in FIG. 1, deviceidentifier A is connected to device identifier D via connection 125 thathas a weight of 1, device identifier B is connected to device identifierD via connection 115 that has a weight of 3, and device identifier C isconnected to device identifier D via connection 120 that was establishedusing login information. Referring back to FIG. 2, the merged identifierABC includes device identifiers A, B, and C. The merged identifier ABCis connected to device identifier D via connection 210. The connection210 has a weight 4, which is the sum of the weights for connections 125,115, and 120 shown in FIG. 1. In other embodiments, the weights forconnections that have been merged due to the merging of deviceidentifiers may be obtained using other methods. For example, instead ofsumming the weights of the merged connections, the average weight of themerged connections may be used.

Although FIGS. 1 and 2 illustrate device identifiers, connectionsbetween the device identifiers, and weights for the connections using agraph, this information may be represented using differentrepresentations and/or data structures. For example, as illustrated inTable 1 below, the identifiers, connections, and weights for theconnections illustrated in FIG. 2 may be represented using a table. Asshown in Table 1, the merged identifier ABC is connected to deviceidentifier D and the connection has a weight of 4. Device identifier Dis connected to device identifier G and the connection has a weight of4. Device identifier E is not connected to other device identifiers.Device identifier F is connected to device identifier G and theconnection has a weight of 2. Device identifier F is also connected todevice identifier G using login information from partner X.

TABLE 1 Merged Device Connected Identifier Identifier Identifier WeightLogin info ABC A, B, C D 4 D G 4 E F G 2 Login from partner X

It should be understood that in other embodiments, the deviceidentifiers, connections, and weights for the connections may berepresented using other data structures and/or representations, such asgraphs, tables, charts, trees, etc.

FIG. 3 is a block diagram of an exemplary network architecture 300, inwhich embodiments of the present disclosure may operate. Networkarchitecture 300 includes a tracking server 305, an advertisement server310, a merchant server 315, a content server 320, and a network dataserver 325 that are communicatively coupled to a network 301. Network301 may be a public network (e.g., the Internet), a private network(e.g., a Local Area Network (LAN) or Wide Area Network (WAN)), a wirednetwork (e.g., Ethernet network), a wireless network (e.g., an 802.11network), a cellular network (e.g., a Long Term Evolution (LTE)network), a broadcast network, and/or a combination thereof. Computingdevices may communicate (e.g., send/receive data) with the differentservers using the network 301.

Network architecture 300 also includes a network 350 that iscommunicatively coupled to the network 301 and to devices 355 and 360.In one embodiment, the network 350 may be a residential network or ahome network. For example, the network 350 may be a Wi-Fi network in theresidence of a user. The network 350 may be coupled to the network 301via a service provider that provides network connectivity to residentialusers (e.g., a cable TV service provider, a telephone service provider,an internet service provider, etc.). Network architecture 300 furtherincludes a network 370 that is communicatively coupled to the network301 and devices 355, 375 and 380 that are communicatively coupled to thenetwork 370. In one embodiment, the network 370 may be a businessnetwork, a corporate network, a phone carrier network, and/or a Wi-Finetwork (e.g., a Wi-Fi hotspot). For example, the network 370 may be anetwork that is used by a company to connect multiple computing devicesto each other and to the network 301 (e.g., the Internet).

Each of the networks, servers and devices illustrated in FIG. 3 may becommunicatively coupled to each other. In one embodiment, two componentsmay be communicatively coupled if they communicate with each otherdirectly. For example, the device 355 may be directly coupled to thenetwork 350 (e.g., directly communicate with the network 350). Inanother embodiment, two components may be communicatively coupled evenif they do not communicate with each other directly. For example, thenetwork 350 communicate data with network 301 via one or more routers,switches, other networks, servers, bridges, and/or other components.

Devices 355, 360, 375, and 380 may each be computing devices (e.g.,computing devices, such as a smartphone, a laptop computer, a tabletcomputer, etc.). Each of the devices 355, 360, 375, and 380 may have oneor more device identifiers (e.g., MAC address, IMEI number, serialnumber, UDID, etc.) Device 355 includes applications 356 and 357 (e.g.,a web browser, a game, an email application, etc.). Each of theapplications 356 and 357 may also have one or more device identifiers(e.g., cookie IDs, GUIDs, a hash generated based on a MAC address of thedevice 355, etc.). Device 380 includes applications 381 and 382, andeach of the applications 381 and 382 may have one or more deviceidentifiers. Device 375 includes application 376 (e.g., a media player).Each of applications 356, 357, 376. 381 and 382 may have their ownunique identifiers and therefore, may also be considered unique devicesin the device graph. As shown in FIG. 3, device 355 may use both network350 and network 370 (as indicated by the dotted line). For example, thedevice 355 may be a smartphone or a laptop computer for a user. The usermay use the device 355 on network 350 (e.g. at home or on a homenetwork) and may later use the device 355 on network 370 (e.g., at work,on a business network, on a carrier network, and/or on a Wi-Fi network).

The merchant server 315 may be a server that hosts a merchant website.For example, the merchant server 315 may host an online store thatallows users to purchase products and/or services online. The merchantserver 315 may obtain a device identifier from a device (e.g., device355 or application 356 on the device 355) that accesses the merchantserver 315. For example, the merchant server 315 may obtain the IPaddress of the device 355 and/or may obtain the cookie ID for a webbrowser (e.g., application 356). The merchant server 315 may provide thedevice identifier, as well as other network data (e.g., a time ortimestamp, an identifier for the merchant server 315, etc.) to thetracking server 305. The content server 320 may be a server thatprovides content to a user. For example, the content server 320 may hosta news website that provides news, updates, and other information to auser. In another example, the content server 320 may be a server thathosts a social networking website or an email website. The contentserver 320 may obtain a device identifier from a device (e.g., device380 or application 381 on the device 380) that accesses the contentserver 320. For example, the content server 320 may obtain the cookie IDof the device 380 of a browser on that device and/or may obtain theAndroid® ID through an email application (e.g., application 381) on thatdevice. The content server 320 may provide the device identifier, aswell as other network data (e.g., a time or timestamp, an identifier forthe content server 320, the type of content that was accessed, etc.) tothe tracking server 305. In one embodiment, one or more of the merchantserver 315 and the content server 320 may generate, update, and/or storean audience record (e.g., indicating that the device belongs to acertain audience/segment/group). For example, the content server 320 maygenerate and/or update an audience record that may include a list orother data indicative of different device identifiers accessed certaincontent (e.g., a certain news article, a certain webpage, etc.). Inanother example, the merchant server 315 may generate and/or update anaudience record that may include a list or other data indicative ofdifferent device identifiers that have view a particular item (e.g., atent), or a category of items (e.g., camping equipment). In anotherembodiment, the tracking server 305 may generate, update, and/or storethe audience record. For example, merchant server 315 and/or the contentserver 320 may include a pixel (e.g., a tracking pixel) that is providedby the tracking server 305 or the publisher for tracking server 305. Thepixel may allow the tracking server 305 to track the device identifiersfor devices that have accessed content on the merchant server 315 and/orthe content server 320, and to generate/update the audience record.

The advertisement server 310 may be a server that providesadvertisements (e.g., ads) to the other servers and/or to the devices355. For example the advertisement server 310 may provide anadvertisement to the content server 320 and the content server mayprovide the advertisement, along with content (e.g., a news article) toa device, such as device 355. In another example, the advertisementserver 310 may provide the advertisement to the device 355 itself. Inone embodiment, the advertisement server 310 may generate, update,and/or store an impression history. The impression history may be a listor other data indicating the different advertisements that have beenprovided to different devices (e.g., provided to an application, such asa web browser, or a computing device, such as a smartphone). Theadvertisement server 310 may obtain the device identifier for the device(e.g., from content server 320 or merchant server 315) and may associatethe device identifier with each advertisement in order to track whetheran advertisement has been displayed, shown, or provided to the device.In one embodiment, the advertisement 310 may perform targeting,attribution, behavioral analysis, frequency capping, and lookalikemodeling, based on a device graph received from the identifier module306 (as discussed below in more detail in conjunction with FIGS. 4 and7). In another embodiment, the advertisement server 310 may generate,update, and/or store an impression history. The impression history mayinclude a list or other data indicative of different device identifiersthat have received advertisements from the advertisement server 310.

The tracking server 305 includes identifier module 306. The trackingserver 305 may use the identifier module 306 to obtain and/or generateone or more device graphs (e.g., as illustrated in FIGS. 1 and 2). Inone embodiment, the identifier module 306 may obtain network data fromthe network data server 325 and may use the network data to obtainand/or generate the device graphs. In another embodiment, the identifiermodule 306 may obtain network data from one or more of the contentserver 320 and the merchant server 315. In one embodiment, theidentifier module 306 may periodically request network data (e.g.,request network data once an hour, once a day, etc.) from one or more ofthe merchant server 315, the content server 320, and the network dataserver 325. In another embodiment, one or more of the merchant server315, the content server 320, and the network data server 325 mayperiodically provide the network data to the identifier module 306 ormay provide the network data to the identifier module 306 whenever newnetwork data is obtained.

The identifier module 306 may analyze the network data to determinewhether the network data should be used when creating the device graphs.In one embodiment, the identifier module 306 may use only network datathat indicates that the device associated with a device identifier wasusing a residential or home network. For example, the identifier module306 may discard or may not use network data that is obtained from abusiness network because the devices (e.g., computing devices orapplications) on a business network may not be closely associated witheach other. This may help prevent the identifier module from creatingconnections between devices which are not closely associated with eachother. For example, this may prevent the identifier module 306 fromcreating a connection between a first device identifier for laptopcomputer used a user and a second device identifier for a desktopcomputer used by a co-worker of the user. In another embodiment, theidentifier module 306 may use network data that is obtained from abusiness network to adjust the weights of the connections if devicesthat use the business network were previously seen on a home orresidential network. In another embodiment, the identifier module 306may use network data that is obtained, such as location data (e.g., adevice's GPS location) or contextual data (e.g., accessing a specificnews site every day) to adjust the weights to show a stronger connectionbetween two device identifiers (e.g., increase the weight of aconnection).

In one embodiment, the identifier module 306 may discard network datafrom a network if more than a threshold number of devices use thenetwork within a threshold amount of time. For example, if more thanfive devices (e.g., more than five computing devices) use a particularnetwork within an hour, the network data associated with that network(e.g., network data that includes an identifier for that network) may bediscarded or may not be used.

The identifier module 306 may also remove device identifiers from thedevice graph, based on network data. In one embodiment, if a deviceidentifier is connected to more than a threshold number of deviceidentifier within a threshold amount of time, the identifier module mayremove the device identifier and its associated connections from thedevice graph. For example, if a device identifier is connected to morethan five other device identifiers within an hour, the device identifierand its associated connections may be removed from the device graph. Inanother embodiment, the identifier module 306 may remove a deviceidentifier and its associated connections from the device graph if thedevice identifier is connected to more than a threshold number of otherdevice identifiers. For example, the identifier module 306 may remove adevice identifier if it is connected to more than forty other differentdevice identifiers. In a further embodiment, the identifier module 306may remove a device identifier and its associated connections from thedevice graph if the device identifier is included in network data over athreshold number of times within a threshold period of time. Forexample, the identifier module 306 may remove a device identifier fromthe device graph if the device identifier appears in five differentnetwork data sets received from different servers within an hour,because this may indicate that the device associated with the deviceidentifier may not be a consumer computing device (e.g., the device maybe a proxy server computer that forwards and receives data for multiplecomputing devices).

The identifier module 306 may also adjust the weights of the connectionsbetween device identifiers based on how frequently and/or recently thedevice identifiers appear on the same network. In one embodiment, theidentifier module 306 may increase the weight of a connection betweentwo device identifiers, if the two device identifiers have recentlyappeared on the same network (e.g., both device identifiers used thesame residential network) within a threshold period of time. Forexample, the weight of a connection between two device identifiers maybe increased by one (or some other value) each time the two deviceidentifiers appear on the same network within the last seven days. In afurther embodiment, the identifier module 306 may decrease the weight ofa connection between two device identifiers, if the two deviceidentifiers do not appear on the same network within a threshold amountof time. For example, if two device identifiers to not use the samenetwork within a month, the weight of the connection between the twodevice identifiers may be decreased. In one embodiment, the identifiermodule 306 may remove a connection that has weight of zero from thedevice graph (e.g., the two device identifiers may not longer beconnected or associated with each other). In another embodiment, theidentifier module 306 may remove device identifiers that have noconnections to other device identifiers from the device graph after aperiod of time. For example, a device identifier may be removed from thedevice graph if the device identifier has had no connections for longerthan fourteen days or the device has not been refreshed in fourteendays.

It should be understood that in other embodiments, different thresholdperiods of time (e.g., 30 minutes, 2 hours, 5 days, 1 month, etc.) anddifferent threshold values (e.g., 5, 20, 100) may be used by theidentifier module 306 when determining whether to use network data, whendetermining whether to remove device identifiers and connections, and/orwhen adjusting the weights of the connections. In other embodiments, theweights may be values other than numeric values. For example, theweights may be alphanumeric strings. The weights may also use differentscales (e.g., a lower value may indicate that two identifiers are moreclosely associated instead of a higher value). In addition, in someembodiments, the identifier module 306 may remove merged identifiers,may remove connections connected to the merged identifiers, and/or mayadjust the weight for connections connected to the merged identifiers.

FIG. 4 is a block diagram illustrating an identifier module 400 and anadvertising module 450, according to one embodiment. In one embodiment,the identifier module 400 and the advertising module 450 may reside onthe same computing device (e.g., on the same server). In anotherembodiment, the identifier module 400 and the advertising module 450 mayreside on different computing devices (e.g., identifier module 400resides on a tracking server and advertising module 450 resides on anadvertisement server, as illustrated in FIG. 3). More or less componentsmay be included in the identifier module 400 and/or the advertisingmodule 450 without loss of generality.

The identifier module 400 may create and/or obtain device graphs (asillustrated in FIGS. 1 and 2) based on network data and/or logininformation and may update the device graphs (e.g., add/remove deviceidentifiers, add/remove connections, adjust or modify the weights forthe connections) based on the network data and/or login information, asdescribed above in conjunction with FIGS. 1-3. The identifier module 400includes a connection module 405, a weight adjustment module 410, and amerging module 415.

In one embodiment, the connection module 405 may identify connectionsbetween device identifiers. For example, the connection module 405 mayidentify a connection between two device identifiers if network dataindicates that the two device identifiers have appeared on the samenetwork. In another example, the connection module 405 may identify aconnection between two device identifiers if the two devices associatedwith the device identifiers use the same login information to accesscontent from an advertiser/publisher. In another embodiment, theconnection module 405 may add a new device identifier to a device graphand may add a connection for the new device identifier to an existingdevice identifier in the device graph, based on the network data. In afurther embodiment, the connection module 405 may remove deviceidentifiers and/or connections between the device identifiers from thedevice graphs, based on various criteria or conditions, as discussedabove in conjunction with FIG. 3.

In one embodiment, the weight adjustment module 410 may adjust or modifythe weight of the connections between different device identifiers. Forexample, the weight adjustment module 410 may increase a weight of aconnection between two device identifiers if the two device identifiersuse the same network within a period of time. In another example, theweight adjustment module 410 may decrease the weight of the connectionbetween two device identifiers if the two device identifiers do not usethe same network for a period of time.

The merging module 415 may merge different device identifiers into amerged identifier, as illustrated in FIG. 2. In one embodiment, themerging module 415 may merge two device identifiers if the two deviceidentifiers are associated with the same user credentials for a server.For example, the merging module 415 may merge two device identifiers ifthe two devices that are associated with the two device identifiers havelogged into the same server (e.g., the same email site, the same socialnetwork site) using the same user credentials (e.g., username, password,etc.). The user credentials (e.g., the login information) associatedwith the device identifiers may be obtained from a server (e.g., anetwork data server, a content server, a merchant server, etc.). Inanother embodiment, the merging module 415 may merge two deviceidentifiers if the merging module 415 determines that the two deviceidentifiers originate from the same computing devices. For example, themerging module 415 may merge two device identifiers if the first deviceidentifier is for a smartphone and the second device identifier is foran application installed on the smartphone. In another embodiment,device identifier may be merged when cookie syncing is performed.

The identifier module 400 may be communicatively coupled to theadvertising module 450. The advertising module 450 includes a targetingmodule 455, an attribution module 460, an analytics module 465 and adata store 470. The identifier module 400 may provide device graphs (asillustrated in FIGS. 1 and 2) to the advertising module 450. In oneembodiment, the identifier module 400 may provide other types of dataindicative of device identifiers, connections between the deviceidentifiers, and weights to the advertising module 450. For example, theidentifier module 400 may provide data such as Table 1, to theadvertising module 450. The advertising module 450 may use the devicegraphs and/or other data provided by the identifier module 400 toperform one or more ad targeting/retargeting, ad attribution, andanalysis of advertisements and user behaviors.

In one embodiment, the targeting module 455 may perform target orre-target advertisements to different devices, based on a device graph.For example a first device (e.g., a laptop computer) associated with afirst device identifier (e.g., a cookie ID) may have visited aparticular website. The device graph may indicate that the first deviceidentifier is connected to a second device identifier and that theconnection has a high weight (e.g., the first device is closelyassociated with the second device, such as a smartphone) or that theconnection has been established based on login information from partners(e.g., advertisers, publishers). The targeting module 455 may providethe same advertisements or the same types of advertisements that wereprovided to the first device, to the second device. For example, anadvertisement for camping gear may have been provided to the firstdevice. The targeting module 455 may provide other advertisements forthe same camping gear or may provide advertisements for items and/orservices related to camping, to the second device.

In one embodiment, the targeting module 455 may add the first deviceidentifier and the second device identifier to an audience record. Theaudience record may later be used to perform ad targeting and/orretargeting. For example, the targeting module 455 may target all deviceidentifiers in an audience record with the same advertisements. Thetargeting module 455 may add device identifiers A, B, C, and D to theaudience record because those device identifiers are connected to eachother and the connections have higher weights or that the connectionshave been established based on login information from partners (e.g.,advertisers, publishers). The device graph may allow the targetingmodule 455 to target ads to a user across multiple computing devices(e.g., target ads to a laptop computer, a tablet computer, a smartphone,a game console, and a smart TV that all belong to the same user) therebyimproving reach, effectiveness, and value of the advertisements oradvertising campaign. In one embodiment, the targeting module 455 mayupdate, modify, and/or optimize an advertisement campaign based on thedevice graph and/or the impression history. For example, the impressionhistory may indicate the number of times different devices have seen acertain advertisement. The targeting module 455 may switch to adifferent advertisement if that certain advertisement has been providedtoo many times to the different devices used by the user.

In another embodiment, the targeting module 455 may providetargeting/retargeting of other content besides advertisements, using thedevice graph and an impression history. For example, a news website mayuse the device graph and an impression history (that may include a listof content viewed by a user) to determine what articles that user hasread across different devices (e.g., different computing devices) inorder identify additional news articles that the user may be interestedin. In another example, a bank may use the device graph to determinewhat types of searches a user has performed for different bankingservices across different devices (e.g., across different applicationsand/or computing devices). The bank may provide a particular bankingoffer (e.g., 0% interest) based on the searches performed using themultiple computing devices.

The attribution module 460 may perform ad attribution. For example, theattribution module 460 may attribute a conversion event (e.g., sale of aproduct and/or a service) to a particular advertisement (e.g., to ashowing of the advertisement). Current methods of ad attributiongenerally work with a single identifier (e.g., a cookie ID) on a singlecomputing device. For example, a user generally should view an ad andpurchase a product in order for the purchase to be correctly attributedto the viewing of the ad. However, the attribution module 450 may usethe device graph and the impression history to perform attributionacross different devices. For example, a user may purchase an item froma vendor using a first device (e.g., a laptop computer) with a firstidentifier. The attribution module 460 may analyze the device graph toobtain other device identifiers (e.g., other devices) connected to thefirst device identifier. The attribution module 460 may then use theimpression history to see if any advertisements from the vendor wereprovided to other devices associated with the other device identifiers.The attribution module 460 may determine that an advertisement from thatvendor was previously displayed to a second device (e.g., a smartphone)and may attribute the conversion (e.g., a sale of an item) to thatparticular advertisement.

The analytics module 465 may perform one or more of brand studies,creative ad delivery, cross-device reporting, behavior analysis acrossdevices, frequency capping, and lookalike modeling, based using thedevice graph and/or impression histories and/or audience records. In oneembodiment, the analytics module 465 may perform creative ad deliveryusing the device graph and/or the impression history. For example, anadvertisement may include three videos that present a story when shownin sequence (e.g., in order). When determining which of the three videosto show to a first device, the analytics module 465 may analyze thedevice graph to identify other device identifiers that are connected tothe first device's device identifier. The analytics module 465 may thenaccess the device graph and/or an impression history to determinewhether any of the three videos were shown to other devices that areassociated with the device identifiers. For example, the analyticsmodule may determine that the first two video have already been shown toother devices in the device graph and/or the impression history, and mayprovide the third video to the first device.

In one embodiment, the analytics module 465 may perform behavioranalysis across different computing devices of the user (e.g., acrossdevices) using the device graph. For example, the analytics module 465may determine that a user typically does online shopping during aparticular time (e.g., during a lunch break) no matter what computingdevice the user is using. In another example, the analytics module 465may determine that the user only reads his email from a particular emailsite using the user's laptop computer.

In one embodiment, the analytics module 465 may perform frequencycapping using the device graph and/or the impression history. Forexample, the analytics module 465 may determine that a particularadvertisement has been shown to other device that are associated with acurrent device, more than a threshold number of times (e.g., anadvertisement has already been shown to a user 5 times across theirlaptop computer, smartphone, and tablet computer). The analytics module465 may determine the advertisement should not be provide to the user onthe current device (e.g., may cap or limit the number of times theadvertisement is shown) in order to help prevent overexposure of theadvertisement.

In one embodiment, the analytics module 465 may perform look-alikemodeling using the device graph and/or the audience record. Lookalikemodeling may be used by advertisers to target users which may a similarcharacteristics, features and/or behaviors. For example, lookalikemodeling may be use to target people who enjoy the outdoors or peoplewho enjoy playing a particular sport. The analytics module 465 mayanalyze a device graph and identify connections that have lower weights(e.g., because the device identifiers for the connections are not seenon the same network as often). The analytics module 465 may target thesedevice identifiers to perform look-alike modeling. For example, a usermay have a friend that periodically visits the user's home and uses theuser's home Wi-Fi network to browse content online. The friend may use adifferent computing device with a different device identifier. Thedifferent device identifier may be weakly associated with the user'scomputing devices, because it is seen on the same network as the othercomputing devices. The friend may have the same interest,characteristics, or behaviors as the user (e.g., both the friend and theuser may be interested in football, or both enjoy the same type ofmusic, etc.). The analytics module 465 may target the friend's computingdevice with the same ads targeted to the user's computing devices, basedon the lookalike modeling.

In one embodiment, the analytics module 465 may perform a brand studyusing the device graph. For example, using the device graph and animpression record, the analytics module may determine the number oftimes advertisements from a particular company or for a particularproduct (e.g., for a particular brand) were displayed to differentusers, independent of the device. The analytics module 465 may determinewhether certain companies or products (e.g., certain brands) are ofinterest to different users, based on the number of advertisements forthe company or products that were viewed by the user.

In one embodiment, the analytics module 465 may perform a cross-deviceanalysis using the device graph. For example, the analytics module may465 may analyze a user's actions (e.g., which advertisements a user hasviewed and whether any conversions resulted from those advertisements)across different devices using the device graph and an impressionhistory. The device graph and the impression history may allow theanalytics module to determine which advertisements were displayed to auser on what device. The analytics module 465 may generate across-device report that indicates the different advertisements thatwere displayed on the devices the advertisements were displayed on.

FIGS. 5-7 are flow diagrams illustrating methods for creating, managing,updating, and/or using device graphs. For simplicity of explanation, themethods are depicted and described as a series of acts. However, acts inaccordance with this disclosure can occur in various orders and/orconcurrently and with other acts not presented and described herein.Furthermore, not all illustrated acts may be required to implement themethods in accordance with the disclosed subject matter. In addition,those skilled in the art will understand and appreciate that the methodscould alternatively be represented as a series of interrelated statesvia a state diagram or events.

FIG. 5 is a flow diagram illustrating a method 500 of identifyingconnections, according to one embodiment. The method 500 may beperformed by processing logic that comprises hardware (e.g., circuitry,dedicated logic, programmable logic, microcode, etc.), software (e.g.,instructions run on a processor to perform hardware simulation), or acombination thereof. In one embodiment, method 500 may be performed byan identifier module, as shown in FIGS. 3-4.

Referring to FIG. 5, the method 500 starts at block 505 with theidentifier module receiving multiple identifiers (e.g., deviceidentifiers). For example, the identifier module may receive networkdata from multiple servers (e.g., a content server, a merchant server, anetwork data server, etc.) The network data may include multipleidentifiers. At block 510 the identifier module may identify connectionsbetween the identifiers. For example, the identifier module may analyzethe network data to determine whether devices (e.g., computing devices,applications, software, etc.) associated with two different identifierswere seen on the same network (e.g., the same residential network) orthe connection can be established based on login information frompartners (e.g., advertisers, publishers). The identifier module mayassign weights to the connections between the multiple identifiers(block 515). Optionally, at block 520, the identifier module may mergemultiple identifiers into a merged identifier and merge the connectionsfor the multiple identifiers. For example, the identifier module maymerge two identifiers together if the two identifiers are recognized ascoming from the same device.

At block 525, the identifier module may receive additional network dataassociated with one or more or the identifiers and may adjust theweights for one or more connections, based on the additional networkdata. For example, the identifier module may increase the weight of aconnection between two identifiers because the additional network dataindicates that the device associated with the two identifiers used thesame network. After adjusting the weights for the one or moreconnections, the identifier may provide content to a device (e.g., acomputing device, an application, etc.) based on one or more of theconnections and/or one or more of the weights (e.g., block 530). Afterblock 530, the method 500 ends.

FIG. 6 is a flow diagram illustrating a method 600 of updatingconnections and weights in a device graph, according to one embodiment.The method 600 may be performed by processing logic that compriseshardware (e.g., circuitry, dedicated logic, programmable logic,microcode, etc.), software (e.g., instructions run on a processor toperform hardware simulation), or a combination thereof. In oneembodiment, method 600 may be performed by an identifier module, asshown in FIGS. 3-4.

Referring to FIG. 6, the method 600 starts at block 605 with theidentifier module analyzing the identifiers (e.g., device identifiers),connections, and/or the weights for the connections in a device graph(as illustrated in FIGS. 1-2). At block 610, the identifier module maydetermine whether any identifiers have greater than a threshold numberof new connections. For example, the identifier module may determinewhether an identifier has had more than twenty-four new connectionsadded within the last hour. If there are identifiers that have greaterthan a threshold number of new connections, the method 600 proceeds toblock 615 where the identifier module removes the connections betweenthe identifiers and/or the identifiers from the device graph. If noidentifiers have greater than the threshold number of new connections,the method 600 proceeds to block 620 where identifier module determineswhether any identifiers have greater than a threshold number of totalconnections. For example, the identifier module may determine whetherany identifiers have greater than forty connections. If there areidentifiers that have greater than the threshold number of totalconnections, the method 600 proceeds to block 625 where the identifiermodule removes the identifiers and/or the connections between theidentifiers.

If no identifiers have greater than the threshold number of totalconnections, the method 600 proceeds to block 630 where the identifiermodule determines whether any identifiers have used (e.g., have beenobserved or seen on) the same network within a threshold time. Forexample, the identifier module may determine whether two identifiershave been seen on the same network within the last seven days. If thereare identifiers that have been seen on the same network within thethreshold time, the method 600 proceeds to block 635 where theidentifier module increases the weight of the connections between theidentifiers that have been seen on the same network. If no identifiershave been seen on the same network within the threshold time, the method600 proceeds to block 640 where the identifier module determines whetherthere are any identifies that have not been seen on the same networkwithin a threshold time. For example, the identifier module maydetermine whether there are any identifiers that have not been seen onthe same network in the last thirty days. If there are identifiers thathave not been seen on the same network within a threshold time, themethod 600 proceeds to block 645 where the identifier module decreasethe weights of the connections between the identifiers. After block 645,the method 600 ends.

FIG. 7 is a flow diagram illustrating a method of using a device graph,according to one embodiment. The method 700 may be performed byprocessing logic that comprises hardware (e.g., circuitry, dedicatedlogic, programmable logic, microcode, etc.), software (e.g.,instructions run on a processor to perform hardware simulation), or acombination thereof. In one embodiment, method 700 may be performed byan advertising module, as shown in FIG. 4.

The method 700 starts at block 705 where the advertising module receivesa device graph. For example, the advertising module may receive thedevice graph from an identifier module (as illustrated in FIGS. 3-4).After receiving the device graph, the method 700 may proceed to one ormore of blocks 710, 720, 730, 740, 750 and 760. If the method proceedsto block 710, the advertising module may perform targeting and/orretargeting of ads based on the device graph (as discussed above inconjunction with FIG. 4). After block 710, the method 700 proceeds toblock 715 where the advertising module may generate an audience recordor may update an existing audience record, based on the targeting and/orretargeting of ads. If the method proceeds to block 720, the advertisingmodule receives data indicating the conversion event (e.g., sale of anitem and/or a service). After block 720, the method 700 proceeds toblock 725 where the advertising module may analyze the device graph andthe impression history to attribute the sale to a particularadvertisement (as discussed above in conjunction with FIG. 4). If themethod 700 proceeds to block 730 the advertising module may performaudience analysis (e.g., may analyze the behavior of a user) based onthe device graph, an audience record, and/or an impression history. Atblock 735, the advertising module may provide content (e.g., anadvertisement) to a device based on the audience analysis (as discussedabove in conjunction with FIG. 4).

If the method 700 proceeds to block 740 the advertising module mayperform ad frequency capping based on the device graph and theimpression history (as discussed above in conjunction with FIG. 4). Atblock 745, the advertising module may provide content (e.g., anadvertisement) to a device based on the ad frequency capping. If themethod 700 proceeds to block 750 the advertising module may performlookalike modeling based on the device graph, an impression history,and/or an audience record (as discussed above in conjunction with FIG.4). At block 755, the advertising module may provide content (e.g., anadvertisement) to a device based on the lookalike modeling. If themethod 700 proceeds to block 760, the advertising module may perform across-device analysis based on the device graph, an audience record,and/or an impression history. At block 765, the advertising module mayprovide a cross-device report/analysis to a server or a user.

FIG. 8 illustrates a diagrammatic representation of a machine in theexemplary form of a computer system 800 within which a set ofinstructions, for causing the machine to perform any one or more of themethodologies discussed herein, may be executed. The system 800 may bein the form of a computer system within which a set of instructions, forcausing the machine to perform any one or more of the methodologiesdiscussed herein, may be executed. In alternative embodiments, themachine may be connected (e.g., networked) to other machines in a LAN,an intranet, an extranet, or the Internet. The machine may operate inthe capacity of a server machine in client-server network environment.The machine may be a Personal Computer (PC), a set-top box, a server, anetwork router, switch or bridge, or any machine capable of executing aset of instructions (sequential or otherwise) that specify actions to betaken by that machine. Further, while only a single machine isillustrated, the term “machine” shall also be taken to include anycollection of machines that individually or jointly execute a set (ormultiple sets) of instructions to perform any one or more of themethodologies discussed herein.

The exemplary computer system 800 includes a processing device (e.g., aprocessor) 802, a main memory 804 (e.g., flash memory, Random AccessMemory (RAM), a static memory 806 (e.g., flash memory, Static RandomAccess Memory (SRAM)) and a data storage device 818, which communicatewith each other via a bus 830.

Processing device 802 represents one or more general-purpose processingdevices such as a microprocessor, central processing unit, or the like.More particularly, the processing device 802 may be a ComplexInstruction Set Computing (CISC) microprocessor, Reduced Instruction SetComputing (RISC) microprocessor, Very Long Instruction Word (VLIW)microprocessor, or a processor implementing other instruction sets orprocessors implementing a combination of instruction sets. Theprocessing device 802 may also be one or more special-purpose processingdevices such as an Application Specific Integrated Circuit (ASIC), aField Programmable Gate Array (FPGA), a Digital Signal Processor (DSP),network processor, or the like. The processing device 802 is configuredto execute the identifier module 826 for performing the operations andsteps discussed herein.

The computer system 800 may further include a network interface device808 which may communicate with a network 820. The computer system 800also may include a video display unit 810 (e.g., a Liquid CrystalDisplay (LCD) or a Cathode Ray Tube (CRT)), an alphanumeric input device812 (e.g., a keyboard), a cursor control device 814 (e.g., a mouse) anda signal generation device 816 (e.g., a speaker).

The data storage device 818 may include a computer-readable medium 828on which is stored one or more sets of instructions (e.g., instructionsof identifier module 826) embodying any one or more of the methodologiesor functions described herein. The identifier module 826 may alsoreside, completely or at least partially, within the main memory 804and/or within the processing device 802 during execution thereof by thecomputer system 800, the main memory 804 and the processing device 802also constituting computer-readable media. The instructions may furtherbe transmitted or received over a network 820 via the network interfacedevice 808.

While the computer-readable storage medium 828 is shown in an exemplaryembodiment to be a single medium, the term “computer-readable storagemedium” should be taken to include a single medium or multiple media(e.g., a centralized or distributed database and/or associated cachesand servers) that store the one or more sets of instructions. The term“computer-readable storage medium” shall also be taken to include anymedium that is capable of storing, encoding or carrying a set ofinstructions for execution by the machine and that cause the machine toperform any one or more of the methodologies of the present invention.The term “computer-readable storage medium” shall accordingly be takento include, but not be limited to, solid-state memories, optical mediaand magnetic media.

In the embodiments described above that obtain may device identifiersfor different devices, or may make use of device identifiers, the usersmay be provided with an opportunity to control whether programs orfeatures collect user information (e.g., device identifiers used by auser's devices), or to control whether and/or how to receive content oradvertisements from a server that may be more relevant to the user. Inaddition, certain data may be modified or obfuscated in one or more waysbefore it is stored or used, so that any personally identifiableinformation is removed (e.g., a hash function may be applied to an IMEInumber or a MAC address). Thus, the user may have control over howinformation is collected about the user and used by different servers.

In the above description, numerous details are set forth. It will beapparent, however, to one of ordinary skill in the art having thebenefit of this disclosure, that embodiments of the invention may bepracticed without these specific details. In some instances, well-knownstructures and devices are shown in block diagram form, rather than indetail, in order to avoid obscuring the description.

Some portions of the detailed description are presented in terms ofalgorithms and symbolic representations of operations on data bitswithin a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here and generally,conceived to be a self-consistent sequence of steps leading to a desiredresult. The steps are those requiring physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical or magnetic signals capable of being stored,transferred, combined, compared and otherwise manipulated. It has provenconvenient at times, principally for reasons of common usage, to referto these signals as bits, values, elements, symbols, characters, terms,numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussion, itis appreciated that throughout the description, discussions utilizingterms such as “receiving,” “identifying,” “assigning,” “adjusting,”“providing,” “determining,” “merging,” “increasing,” “decreasing,”“targeting,” “generating,” “attributing,” “performing,” “obtaining,”“limiting,” or the like, refer to the actions and processes of acomputer system, or similar electronic computing device, thatmanipulates and transforms data represented as physical (e.g.,electronic) quantities within the computer system's registers andmemories into other data similarly represented as physical quantitieswithin the computer system memories or registers or other suchinformation storage, transmission or display devices.

Embodiments of the invention also relate to an apparatus for performingthe operations herein. This apparatus may be specially constructed forthe required purposes, or it may comprise a general purpose computerselectively activated or reconfigured by a computer program stored inthe computer. Such a computer program may be stored in a non-transitorycomputer readable storage medium, such as, but not limited to, any typeof disk including floppy disks, optical disks, CD-ROMs andmagnetic-optical disks, Read-Only Memories (ROMs), Random AccessMemories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, flashmemory, or any type of media suitable for storing electronicinstructions.

The algorithms and displays presented herein are not inherently relatedto any particular computer or other apparatus. Various general purposesystems may be used with programs in accordance with the teachingsherein, or it may prove convenient to construct a more specializedapparatus to perform the required method steps. The required structurefor a variety of these systems will appear from the description below.In addition, the present invention is not described with reference toany particular programming language. It will be appreciated that avariety of programming languages may be used to implement the teachingsof the invention as described herein.

The above description sets forth numerous specific details such asexamples of specific systems, components, methods and so forth, in orderto provide a good understanding of several embodiments of the presentinvention. It will be apparent to one skilled in the art, however, thatat least some embodiments of the present invention may be practicedwithout these specific details. In other instances, well-knowncomponents or methods are not described in detail or are presented insimple block diagram format in order to avoid unnecessarily obscuringthe present invention. Thus, the specific details set forth above aremerely exemplary. Particular implementations may vary from theseexemplary details and still be contemplated to be within the scope ofthe present invention.

The words “example” or “exemplary” are used herein to mean serving as anexample, instance, or illustration. Any aspect or design describedherein as “example’ or “exemplary” is not necessarily to be construed aspreferred or advantageous over other aspects or designs. Rather, use ofthe words “example” or “exemplary” is intended to present concepts in aconcrete fashion. As used in this application, the term “or” is intendedto mean an inclusive “or” rather than an exclusive “or”. That is, unlessspecified otherwise, or clear from context, “X includes A or B” isintended to mean any of the natural inclusive permutations. That is, ifX includes A; X includes B; or X includes both A and B, then “X includesA or B” is satisfied under any of the foregoing instances. In addition,the articles “a” and “an” as used in this application and the appendedclaims should generally be construed to mean “one or more” unlessspecified otherwise or clear from context to be directed to a singularform. Moreover, use of the term “an embodiment” or “one embodiment” or“an implementation” or “one implementation” throughout is not intendedto mean the same embodiment or implementation unless described as such.

It is to be understood that the above description is intended to beillustrative and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reading and understanding theabove description. The scope of the invention should, therefore, bedetermined with reference to the appended claims, along with the fullscope of equivalents to which such claims are entitled.

What is claimed is: 1.-20. (canceled)
 21. A method comprising:assigning, by at least one processor, a device identifier to arespective application accessing network data sources executing onrespective user devices; receiving, by the at least one processor,network activity information associated with a first identifier and asecond identifier; identifying a connection between at least the firstidentifier and the second identifier based on a first set of networkdata for the first device and the second device, wherein the connectionis indicative of an association between the first device and the seconddevice; generating at least one grouping of device identifiersresponsive to analyzing network activity associated with a common IPaddress; and providing content to one or more of the first device andthe second device, based on the at least one grouping.